itSMF Switzerland - Blog #ISO31000

Resilience and crisis management according to the ISO 22361 standard

Wed, 04 Jun 2025 12:13:52 +0200

Reading time: ~ 3 min.

ISO 22361 standard: the resilience and crisis management

The ISO 22361:2022 standard on «Security and resilience – Crisis management – Guidelines» provides an effective guidance for every kind of organizations aside from their type, size or industry to improve their crisis management capability.

This document is useful not only to plan, but also to set, keep up-to-date and enhance the strategic crisis management ability in every organization. It helps also to improve the capability to identify and manage crisis.

The ISO 22361 standard is relevant for the top management (strategic responsabilities) and useful for everyone who operates under the direction of top management. The guidance has several relationships and interdepencies with other topics.

In particular, the application of ISO 22361 can be suggested by ISO 22301:2019 standard on «Security and resilience – Business continuity management systems requirements».

This document defines the requirements for a business continuity management system, remembering that crisis management is very important.

The ISO 22361:2022 standard structure

The ISO 22361:2022 helps to design and develop the crisis management capability in organizations, setting out the principles and practises needed.

Organizations have to provide committed leadership, structures, supportive culture and competent personnel to enhance their crisis management capability. To make effective their approach to crisis management, organizations should apply a set of principles that determine the development of a crisis management framework.

The standard outlines them into the following main clauses:

Chapter 1: scope
Chapter 2: normative reference
Chapter 3: terms and definitions
Chapter 4: crisis management – context, core concepts, principles
Chapter 5: building a crisis management capabilities (with crisis management framework and crisis management process focus)
Chapter 6: crisis leadership
Chapter 7: strategic crisis decision making (challenges and complexities)
Chapter 8: crisis communication (guidelines from strategy, management of relationships and reputation, consistency of message, …)
Chapter 9: training, validation and learning from crises.

Our infographic on ISO 22361:2022 standard

To better figure out the «big picture» on ISO 22361 standard, take a look at our infographic:

ISO 22361 standard and its main references

The ISO 22361 standard not only provides an effective guidance on «Security and resilience – Crisis management»: it can be used to in the context of management systems for information security (ISO 27001 standard) and for IT services (ISO 20000-1 standard).

If we extend our point of view on ISO 22361 to other regulations, we find many references in the following:

📘 European Directive NIS 2 cybersecurity
📘 European DORA regulation (Digital Operational Resilience Act) for the finance sector
📘 Bank of Italy Circular 285 for resilience requirements
📘 Circular 01/2023 from FINMA (Switzerland) for resilience requirements

If you want to keep you up-to-date with the most recent news on this topic, don't forget to subscribe to our newsletter: you will get a monthly update with the most relevant and valuable content from our experts!

SUBSCRIBE TO OUR NEWSLETTER

Need to know more about it?

Click on one of the options below to enter in the itSMF Enviroment and for being updated the way which is best for you.

Subscribe to itSMF Newsletter

DISCOVER OUR EVENT CALENDAR

Get the benefits of Membership Program

Our sponsors

A special thanks to our Advanced Sponsors:

The information security risk management according to the ISO 27005 standard

Tue, 15 Apr 2025 09:43:13 +0200

Reading time: ~ 2 min.

ISO 27005 standard: the risk management of the information security

The ISO/IEC 27005:2022 standard on «Information security, cybersecurity and privacy protection — Guidance on managing information security risks» provides a useful guidance for all kind of organizations (no matter which type, size or industry).

ISO 27005 is useful for all the organizations that have already adopted an Information Security Management System according to the ISO 27001 standard to evaluate (assessment) and treat the information security risks.

If you want to have an overview on ISO/IEC 27001 Information Security Management System, check out our previous post. in the next lines, we're going to have a look at the 27005 standard structure.

The ISO/IEC 27005 standard structure

The ISO/IEC 27005 standard has 10 main chapters and an «ANNEX A». This is an overview on the structure:

Chapter 1: scope
Chapter 2: normative reference
Chapter 3: terms and definitions; with focus on:

3.1 «terms related to information security risk»
3.2 «terms related to information security risk management».

Chapter 4: structure of the document
Chapter 5: information security risk management; with focus on:

5.1 «information security risk management process»
5.2 «information security risk management cycles»

Chapter 6: Context establishment; with focus on:

6.1 Organizational considerations
6.2 Identifying basi requirements of interested parties
6.3 applying risk assessment
6.4 establishing and maintaining information security risk criteria

6.4.1 general
6.4.2 risk acceptance criteria
6.4.3 criteria for performing information security risk assessments

6.5 choosing an appropriate method

Chapter 7 Information security risk assessment process

7.1 general
7.2 identifying information security risks

7.2.1 identifying and describing information security risks
7.2.2 identifying risk owners

7.3 analysing information security risks

7.3.1 general
7.3.2 assessing potential consequences
7.3.3 assessing likelihood
7.3.4 determining the levels of risk

7.4 evaluating the information security risks

7.4.1 Comparing the results of risk analysis with the risk criteria
7.4.2 Prioritizing the analysed risks for risk treatment

Chapter 8 Information security risk treatment process

8.1 general
8.2 selecting appropriate information security risk treatment option
8.3 determining all controls that are necessary to implement the information security
risk treatment options
8.4 comparing the controls determined with those in ISO/IEC 27001:2022, Annex A
8.5 producing a statement of applicability
8.6 information security risk treatment plan

8.6.1 formulation of the risk treatment plan
8.6.2 approval by risk owners
8.6.3 acceptance of the residual information security risks

Chapter 9 Operation

9.1. performing information security risk assessment process
9.2 performing information security risk treatment process

Chapter 10 leveraging related ISMS processes

10.1 context of the organization
10.2 leadership and commitment
10.3 communication and consultation
10.4 documented information

10.4.1 general
10.4.2 documented information about processes
10.4.3 documented inforrmation about results

10.5 monitoring and review

10.5.1 general
10.5.2 monitoring and reviewing factors influencing risks

10.6 management review
10.7 corrective action
10.8 continual improvement

Annex A Examples of techniques in support of the risk assessment process

Our infographic on ISO/IEC 27005:2022 standard

To better figure out the «big picture» about the ISO 27005 standard, take a look at our infographic:

The ISO 27005:2022 is indeed a useful supplementation of the ISO 31000:2018 standard on «risk management – guidelines», as it applies the guidance provided by the second one to the specific topic of the information security risks.

SUBSCRIBE TO OUR NEWSLETTER

Need to know more about it?

Click on one of the options below to enter in the itSMF Enviroment and for being updated the way which is best for you.

Subscribe to itSMF Newsletter

DISCOVER OUR EVENT CALENDAR

Get the benefits of Membership Program

Our sponsors

A special thanks to our Advanced Sponsors:

The ICT consultancy service management according to the ISO 20700 standard

Wed, 02 Oct 2024 07:00:00 +0200

Reading time: ~ 2 min.

The ICT consultancy service management and the ISO 20700 standard

In our post, we're going to take a look at the ISO 20700:2017 on «Guidelines for management consultancy services», a standard that provides useful guidelines for the effective delivery of management consultancy services.

The ISO 20700 standard therefore applies also to the Information & Communication Technology (ICT) consultancy services.

The service delivery processes according to the ISO 20700 standard

The ISO 20700 standard defines in particular three main service delivery processes, which are:

🔖 Contracting

🔖 Execution

🔖 Conclusion.

For each process, the standard takes into consideration the following aspects:

📘 General

📘 Purpose

📘 Inputs

📘 Outcome

📘 Contents

In particular, the policies that direct the management of the service recall some issues related to some specific ISO standards, such as:

✅ Compliance management (see the ISO 37301 standard on «compliance management systems – requirements with guidance for use»);

✅ CSR sustainability (see the ISO 26000 standard on «social responsibility»);

✅ Project governance (see the ISO 21500 standard on «guidance on project management»;

✅ Data protection (see the ISO 27001 standard on «information security, cybersecurity and privacy protection – requirements» and GDPR);

✅ Intellectual Property protection IPR (see the ISO 56005 standard on «innovation management – tools and methods for intellectual property management – guidance»);

✅Health and Safety (see the ISO 45001 standard on «occupation health and safety management systems – requirements with guidance for use»);

✅Quality and Risk (see the standards ISO 9001 on «quality management systems – requirements» and ISO 31000 on «risk management»).

To better figure out the «big picture», take a look at our infographic on ICT consultancy service management according to the ISO 20700 standard and the main related standards:

If you want to keep you up-to-date with the most recent news on this topic, don't forget to follow our social media or subscribe on our newsletter.

Need to know more about it?

Click on one of the options below to enter in the itSMF Enviroment and for being updated the way which is best for you.

Subscribe to itSMF Newsletter

DISCOVER OUR EVENT CALENDAR

Get the benefits of Membership Program

Our sponsors

A special thanks to our Advanced Sponsors:

The EU Network & Information Security 2 (NIS 2) Directive: a GRC approach with the main related ISO standards

Wed, 22 May 2024 18:08:00 +0200

Reading time: ~ 2 min.

The EU Network & Information Security 2 Directive (NIS 2)

Our today post is focused primarily on the Directive (EU) 2022/2555, the Network and Information Security directive issued by the European Parliament and the European Council, which is knowns also as the «NIS 2».

The NIS 2 Directive is focused on measures for a high common level of cybersecurity across the Union, and especially:

amending the Regulation (EU) No. 910/2014 on electronic identification and trust services for electronic transactions in the internal market and repealing Directive 1999/93/EC;
amending the Directive (EU) 2018/1972 of the European Parliament and of the Council of 11 December 2018 establishing the European Electronic Communications Code (Recast)Text with EEA relevance;
repealing the Directive (EU) 2016/1148 of the European Parliament and of the Council of 6 July 2016 concerning measures for a high common level of security of network and information systems across the Union.

We remember that this NIS 2 Direct (date 14 December 2022) entered into force on 13th January 2023 and its implementation in national regulation must be done on 17th October 2024 at the latest.

As an European Directive, it lays down the results or goals that each Member State must achieve, however it is up to the single country to devise their own laws on how to reach these results or goals.

Where does the EU Network & Information Security 2 Directive (NIS 2) apply?

The NIS2 applies to all the sectores that the law defines «critical», such as:

📘 energy;

📘 public services;

📘 financial services;

📘 health services;

📘 telecommunications;

📘 space;

📘 public administration;

📘 ect.

The EU Network & Information Security 2 Directive (NIS 2) structure

The Directive (EU) 2022/2555 on Network & Information Security (NIS 2) is divided in the following chapters:

🔖Whereas (144)

🔖 Chapter I: general provisions

🔖Chapter II: coordinated cybersecurity frameworks

🔖Chapter III: cooperation at union and international level

🔖Chapter IV: cybersecurity risk-management measures and reporting obligations

🔖Chapter V: jurisdiction and registration

🔖Chapter VI: information sharing

🔖Chapter VII: supervision and enforcement

🔖Chapter VIII: delegated and implementing acts

🔖Annex I: sectors of high criticality
🔖Annex II: other critical sectors

How can we manage the compliance with all the requirements set by NIS 2? Our solution is a GRC Approach: let's take a closer look in the chapter below.

How to apply the NIS 2 EU Directive?

We can choose a GRC approach to apply the Directive (EU) 2022/2555 that can be based on the main ISO standards in relationship with the law.

Lets check them out:

✅ ISO 20000-1 on IT services;

✅ ISO 27001 on Information Security; on Risk Management;

✅ ISO 22301 on Business Continuity;

✅ ISO 31000 on Risk Management;

✅ ISO 27035 on Incident Management.

Our infographic on the NIS2 Directive application with our GRC approach (and the main ISO standards)

To better figure out the «big picture», take a look at our infographic:

If you want to keep you up-to-date with the most recent news on this topic, don't forget to follow our social media or subscribe on our newsletter.

Need to know more about it?

Click on one of the options below to enter in the itSMF Enviroment and for being updated the way which is best for you.

Subscribe to itSMF Newsletter

DISCOVER OUR EVENT CALENDAR

Get the benefits of Membership Program

Our sponsors

A special thanks to our Advanced Sponsors:

The EU Regulation on Digital Operational Resilience Act (DORA): GRC approach and main related standards

Wed, 24 Apr 2024 07:00:00 +0200

Reading time: ~ 2 min.

The EU Digital Operational Resilience Act (DORA)

In our post, we're going to take a closer look to the EU Regulation 2022/2554, the Digital Operational Resilience Act for the financial sector issued by the European Parliament and the European Council (known as well as «DORA»).

First of all, we should remember that the EU Regulation (date 14 December 2022) entered into force on 16 January 2023 and it applies to the EU financial service providers.

We have to know that the Digital Operational Resilience Act amended also these regulations:

📘 Regulation (EC) No. 1060/2009;

📘 Regulation (EU) No. 648/2012;

📘 Regulation (EU) No. 600/2014;

📘 Regulation (EU) No. 909/2014;

📘 Regulation (EU) No. 2016/1011.

Let's check out in the next lines which requirements have been set by the lawmakers on the new «DORA».

The Digital Operational Resilience Act: the main requirements

The EU Regulation 2022/2554 defines in particular a set of requirements which are meant to ensure digital resilience and security.

The main parts of the Digital Operational Resilience Act on these matters are in the following chapters:

🔖 1. General Provisions

🔖 2. ICT Risk Management

🔖 3. ICT Related Incident Management Process

🔖 4. Digital Operational Resilience test

🔖 5. Managing of ICT Third Party Risk

🔖 6. Information Sharing Arrangement

How can we manage the compliance with all the requirements set by DORA? Our solution is a GRC Approach: let's take a closer look in the chapter below.

How to manage the compliance with DORA requirements?

We can support the management – in an integrated way – of the requirements set by the Digital Operational Resilience Act with the GRC approach based in particular on these ISO standards:

✅ ISO 38500 on Governance;

✅ ISO 31000 on Risk Management;

✅ ISO 37301 on Compliance Management.

This GRC approach provides a useful basis for addressing and integrating too the main aspects of these reference standards:

📘 Resilience and Business Continuity (ISO 22301);

📘 Information Security (ISO 27001);

📘 ICT Services (ISO 20000-1).

Our infographic on DORA requirements and the related ISO standards

To better figure out the «big picture», take a look at our infographic:

If you want to keep you up-to-date with the most recent news on this topic, don't forget to follow our social media or subscribe on our newsletter.

Need to know more about it?

Click on one of the options below to enter in the itSMF Enviroment and for being updated the way which is best for you.

Subscribe to itSMF Newsletter

DISCOVER OUR EVENT CALENDAR

Get the benefits of Membership Program

Our sponsors

A special thanks to our Advanced Sponsors:

FINMA requirements for ICT resources in Swiss finance industry: GRC approach and main related standards

Wed, 20 Sep 2023 07:00:00 +0200

Reading time: ~ 4 min.

The ICT resources requirements for Swiss finance industry set by FINMA

As you probably already know, in Switzerland FINMA – Eidgenössische Finanzmarktaufsicht; autorité fédérale de surveillance des marchés financiers; autorità federale di vigilanza sui mercati finanziari – is the Financial Market Supervisory Authority.

This authority set indeed a lot of mandatory requirements for all the financial industry players and in particular today we're going to take a closer look at the FINMA Circular 2023/1.

The document has been issued in January 2023 by the authority and it is intended to substitute the previous one – the old Circular 08/21.

In the following lines, we're going to better figure out the main ICT resources requirements set by FINMA for the Swiss financial market that, we have to keep in mind that are subjected to supervision.

The Swiss finance industry ICT resources requirements set by FINMA 23/01 Circular

First of all, we would like to focus our examination on the «Chapter IV» of the aforementioned Circular 23/01 issued by FINMA, due to our GRC approach.

This fourth chapter of the document is indeed about the «Management of Operational Risks» and set in particular these six details:

✅ A. Transversal Management of Operational Risks

✅ B. ICT Risk Management

✅ C. Cyber Risk Management

✅ D. Risk management of critical data

✅ E. Business continuity management (BCM)

✅ F. Management of risks relating to the provision of cross-border services

We just did a brief examination of the Chapter 4 of the FINMA Circular 23/01, but we should keep in mind too that there are other regulations that the document set.

If we take the «Chapter V», we noticed that this one relates to the need of «Ensuring operational resilience».

At this point, we can just have a big question for our compliance strategy: how to can we systematically manage the requirements of the Circular 2023/01 applicabile to the ICT resources?

How to manage the ICT requirements for Swiss finance industry set by FINMA according to the more relevant ISO standards

It is probably correct to say that a modern GRC approach – base on the main ISO standards we can put in relation with the matter – can help us on supporting the integrated management of all the requirements applicable to ICT resources, which are:

Information security
Business continuity
IT services.

We should now figure out which ones are the ISO standards we can rely on to manage the requirements; and these are indeed:

ISO 38500, for the Governance;
ISO 31000, for the Risk Management;
ISO 37301, for the Compliance Management.

We should remember also that a modern GRC approach allows indeed the adoption and of course the integration of the several reference standards (E.G. ISO standards and the NIST standards), as follows:

📘 ISO 27001 «information security standard», ISO 27110 «cybersecurity framework standard» and the NIST standard;

📘 ISO 22301 «business continuity standard»;

📘 ISO 20000-1 «IT services standard».

To better figure out the «big picture» about what we just described in these last lines, we can bring as usual our infographic.

We end our brief overview on the FINMA requirements on ICT resources set by the Circular 2023/1 inviting you to stay tuned on our blog, social media channels and newsletter, to be always updated on the next news about this topic.

Don't forget to support our effort to bring you the best content quality and sharing value: follow us on our YouTube channel!

Need to know more about it?

Click on one of the options below to enter in the itSMF Enviroment and for being updated the way which is best for you.

Subscribe to itSMF Newsletter

DISCOVER OUR EVENT CALENDAR

Get the benefits of Membership Program

Privacy & Risk Management according to ISO/IEC 27557:2022

Wed, 08 Feb 2023 07:00:00 +0100

Reading time: ~ 3 min.

ISO/IEC 27557:2022 the information security, cybersecurity and privacy protection standard

The ISO/IEC 27557:2022 standard on «information security, cybersecurity and privacy protection– application of ISO 31000:2018 for organizationl privacy risk management» provides a framework for assessing organizational privacy risk.

It is important to note that this framework takes into consideration the privacy impact as a component of the overall organizational risk and particularly in the way that follows:

the organizational consequences of adverse privacy impacts on individuals;
the organizational consequences of privacy events that damage the organization itself (e.g. by harming its reputation) without causing any kind of privacy impacts to individuals.

The relationship between the ISO/IEC 27557:2022 and ISO 31000:2018 standards

It is useful to remember that ISO/IEC 27557:2002 standard is based on the «ISO 31000:2018 – Risk Management – Guidelines».

This standard includes some specific considerations for organizational privacy risk and to support the organizations on the implementation of a Privacy Information Management System (PIMS), according to the «ISO/IEC 27701:2019 Security techniques– Extension to ISO/IEC 27001 and ISO/IEC 27002 for privacy information management – Requirements and guidelines» standard.

The ISO/IEC 27557 standard therefore can be used for integrating risk management and compliance between the privacy requirements set by the EU GPDR and the Swiss FADP (known as LDP and DSG).

It sounds quite interesting but it is a little bit confusing to figure out just considering our brief recap? Let's try to look at things from a different perspective with the help of our steady infographic.

ISO/IEC 27557 standard: the «bridge» to integrate risk management and compliance under EU and Swiss privacy regulations

In order to understand better this kind of scenario where the ISO/IEC 27557 standard can be used for an effective integration of risk management and compliance between the privacy requirements set by the UE GDPR and the Swiss FADP (known as well as LPD and DSG), we can take a look at this infographic:

We end our brief overview on «Privacy & Risk Management according to ISO/IEC 27557:2022 standard» inviting you to stay tuned on our blog, social media channels and newsletter to be always updated on the next news about this topic.

If you want support our effort to bring you the best content quality and sharing value, do not forget to follow us on our LinkedIn page!

If you are interested in this topic, you should consider to attend our Annual IT Service Management Forum Day 2023, as we're going to share the expertise of Digital&Privacy lawyer;ISO, SMS & Data Protection auditor and many other professionals.

More info on our hybrid Annual IT Service Management Forum Day 2023

Need to know more about it?

Click on one of the options below to enter in the itSMF Enviroment and for being updated the way which is best for you.

Subscribe to itSMF Newsletter

DISCOVER OUR EVENT CALENDAR

Get the benefits of Membership Program

GRC and Data Protection: the GRC approch in EU and Swiss contexts

Wed, 04 Aug 2021 05:00:41 +0200

Reading time: ~ 2 min.

Data protection between EU and Switzerland: the GRC Data Protection approach on GDPR and LPD-DSG-LPD (FDA)

GRC and Data Protection: what about the approach in Switzerland?

We already told you about the new Federal Data Protection Act (also known as LPD) that was enacted in Switzerland in our previous post. Today we are getting back on this topic considering one big challenge for the Swiss companies: the GRC and data protection between European Union and Switzerland.

Many organizations in Switzerland will face a double challenge. They have to manage compliance with the requirements of the LPD and, at the same time, with GDPR too. This one - as known - applies also to the EU citizens personal data processing carried out outside of the EU.

Many Swiss companies have to find a solution that could be suitable for both the contexts.
How to manage compliance with the requirements of the LPD and the GDPR in an integrated way?

The adoption of a common GRC approach (Governance, Risk Management, Compliance) based on the main ISO standards can be of great help.

This can be the right choice with particular reference to the following standards:

Risk management according to ISO 31000
Privacy Impact Assesment on ISO 29134
Compliance management (ISO 37301)
Information security management system (ISO 27001)
Business continuity management system (ISO 22301)
IT Service Management System (ISO 20000-1).

Due to this high relevance for a lot of companies, we will have a special focus on topic with a dedicated class.

ITSMF and MGS will have a partnership on the next class about GRC and Data protection between EU and Switzerland.

We will held this class on 6th and 7th October: but you will get more info about during the next weeks.

Need to know more about it?

Click on one of the options below to enter in the itSMF Enviroment and for being updated the way which is best for you.

Subscribe the itSMF Newsletter

DISCOVER THE EVENT CALENDAR

Enter the itSMF Membership Program

GRC and data protection in Switzerland: structure and main requirements of the LPD

Thu, 22 Jul 2021 05:00:08 +0200

Reading time: ~ 2 min.

Data protection in Switzerland: the Swiss Federal Data Protection Act (DPA)

As is known, on September 25th, 2020, the Federal Data Protection Act (LPD) of Switzerland was enacted.
The LPD - similarly to the GDPR - has a three levels structure: you can find on it chapters, sections and single articles.
There are many clear correlations between the requirements of the Swiss LPD and the requirements of the European GDPR. These are:
The purpose and field of application.
The definition of personal data and processing.
The figures involved (data subject, data controller and data processor).
The applicable principles to the processing.
The rights of the data subject.
The privacy by design and by default.
The obligations of data controllers and processors.
The personal data protection.
The role of the data protection consultant.
The purpose and field of application.
The definition of personal data and processing.
The figures involved (data subject, data controller and data processor).
The applicable principles to the processing.
The rights of the data subject.
The privacy by design and by default.
The obligations of data controllers and processors.
The personal data protection.
The role of the data protection consultant.
How to manage the compliance with the requirements of the Swiss LPD? What is the right answer? Remember, every company has to pay attention to and comply with this act!

The adoption of a GRC (Governance, Risk Management and Compliance) approach based on the main ISO standards can be particularly useful, so we will check it on our next blog posts.

We are going to see how it is possible to execute everything in the right way in the next weeks: so please stay tuned!

Keep in mind also that we are going to take a deeper and closer look at this crucial topic on our next class by itSMF with the partnership of MGS.

This class is going to be scheduled on 6th and 7th October. We will keep you in touch shortly with some details and of course the enrollment.

Need to know more about it?

Click on one of the options below to enter in the itSMF Enviroment and for being updated the way which is best for you.

Subscribe the itSMF Newsletter

DISCOVER THE EVENT CALENDAR

Enter the itSMF Membership Program